Categories
Health Law Highlights

Hacking the Hippocratic Oath: Four Ways to Shield Patients from Ransomware Attacks

Summary of article from MedCity News, by Mohammad Wagas:

The healthcare industry is under increasing threat from cyberattacks, highlighting an immediate need for stronger security measures. To address this, four key strategies are recommended: enhancing analysis of security risks, fostering a cybersecurity culture among all staff, segmenting networks to limit potential damage, and ensuring robust external surface defense. Comprehensive risk analysis tools and consistent cybersecurity education for staff are imperative. Implementing a Zero Trust architecture and conducting regular security audits of third-party vendors are also key. These initiatives align with medical ethics and ensure patient safety and their trust in technology.

Categories
Health Law Highlights

Healthcare Cybersecurity: Preventing Data Breaches

Summary of article from Security Boulevard, by Rom Carmel:

The healthcare sector is facing an escalating threat from cyberattacks, with an unprecedented 725 large data breaches reported in 2023. The primary causes are system vulnerabilities, human errors, and a surge in sophisticated cyberattacks. The consequences of these breaches are manifold, including major financial burdens, significant reputational damage, and infringing patient privacy. To mitigate these risks, it’s essential to implement a robust cybersecurity infrastructure, perform regular audits and risk assessments, and provide comprehensive cybersecurity training to employees. Apono, a specialized platform, can support healthcare firms with these preventative measures, contributing to safeguarding patient data, maintaining service integrity, trustworthiness and compliance with industry standards.

Categories
Health Law Highlights

Understanding Barriers to Cyber Resilience in Healthcare

Summary of article from HealthIT Security, by Jill McKeon:

Cyber resilience in healthcare, which enables swift response and recovery from cybersecurity incidents, faces several barriers including a lack of understanding of the concept, misalignment between cybersecurity and business, and the complexity of IT systems. Research by LevelBlue reveals that 76% of healthcare organizations view cyber resilience as primarily the responsibility of cybersecurity teams, rather than an enterprise-wide priority. Budgets are often reactive, with 77% of respondents describing their budgets as such, and there is a notable lack of understanding about cybersecurity at the board level. The rapid innovation in healthcare technology, while beneficial, adds to the cyber risk, making resilience more complex. To improve cyber resilience, healthcare organizations should use reporting metrics and analysis, increase communication at the C-suite level, improve employee training, and adopt resources like the Health Industry Cybersecurity Practices (HICP) for better alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

Categories
Health Law Highlights

Tips to Shorten Healthcare’s Cybersecurity Learning Curve

Summary of article from Healthcare IT News, by Andrea Fox:

Healthcare organizations are struggling with cybersecurity, especially as threats become more sophisticated. Traditional endpoint detection and response systems are proving inadequate, with many able to be bypassed without triggering alerts. Healthcare organizations have unique blind spots due to reliance on basic security measures and a complex digital infrastructure. Artificial intelligence can aid in identifying and responding to threats in real-time, but AI is a tool, not a magic solution. Healthcare organizations and third-party vendors need to adopt advanced threat detection and response technologies, and act as a united front to better resist cyberattacks.

Categories
Health Law Highlights

Checking the Pulse: An Approach to Telehealth Privacy and Cybersecurity Due Diligence

Summary of article from Troutman Pepper, by Brent Hoard, Emma Trivax, Erin Whaley:

The rapid expansion of telehealth introduces complex privacy and cybersecurity challenges, impacting financing or acquisition decisions in the health care sector. A strategic pre-diligence review is advised to identify potential risks and regulatory environment, including HIPAA, FTC’s Health Breach Notification Rule, state-specific privacy laws, and international privacy laws. The pre-diligence review should also include an examination of the target’s privacy policy, website, and data practices. This information should then inform a comprehensive due diligence process, including the development of a request list and a framework for organizing diligence issues. Finally, a plan should be put in place to address any identified compliance risks or business issues pre- and post-acquisition.

Categories
Health Law Highlights

HHS Must Take Immediate Action to Improve Cybersecurity at Large Healthcare Organizations

Summary of article from The HIPAA Journal, by Steve Adler:

Senator Ron Wyden has called on the Department of Health and Human Services (HHS) to take immediate action against large healthcare companies to strengthen their cybersecurity practices. He has criticized HHS for its lack of regulation and oversight, particularly in light of recent cyberattacks on major healthcare organizations, such as Change Healthcare and Ascension. Wyden has recommended the development and enforcement of minimum cybersecurity standards for systematically important entities (SIEs), including resilience to cyberattacks and business continuity. He also suggested that the HHS should stress test SIEs and prioritize their audits. Moreover, he has urged HHS to provide technical assistance and guidance to smaller healthcare organizations through the Centers for Medicare & Medicaid Services (CMS)’s Quality Improvement Organizations and Medicare Learning Network programs.

Categories
Health Law Highlights

Cybersecurity Policy – Developments to Watch

Summary of article from FiscalNote, by Nicole D’Angelo:

Cybercrime costs are projected to rise from $9.22 trillion in 2024 to $13.82 trillion by 2028, with new threats emerging due to advancements in technology, particularly AI. Governments are increasingly focusing on cybersecurity, with several key legislations proposed in 2024, including the Healthcare Cybersecurity Improvement Act and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) in the US, and the EU AI Act, Network and Information Security 2 Directive (NIS2), and Digital Operation Resilience Act (DORA) in the EU. The rise of AI is also leading to new cybersecurity risks, with governments focusing on ensuring AI systems are secure and ethical. The concept of “Security by Design” is gaining traction, encouraging developers to integrate security measures into new products. The Cybersecurity and Infrastructure Security Association (CISA) is offering support to high-risk sectors, such as healthcare and education, to help them mitigate sophisticated cyberattacks.

Categories
Health Law Highlights

HHS Agency Launches Program to Improve Cyber Resiliency in Hospitals

Summary of article from The HIPAA Journal, by Steve Adler:

The Advanced Research Projects Agency for Health (ARPA-H), a Department of Health and Human Services (HHS) agency, has initiated a cybersecurity program aimed at enhancing and automating cybersecurity in U.S. hospitals. The program, called Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE), will invest over $50 million to develop software tools to bolster network defenses against cyberattacks. The software will help identify and mitigate vulnerabilities in hospital systems, intending to reduce the time devices remain vulnerable from several months to a few days. ARPA-H is seeking proposals for the creation of a vulnerability mitigation platform, development of digital twins of hospital equipment, and methods for auto-detecting vulnerabilities and auto-developing defenses. The UPGRADE program is part of HHS’s broader strategy to improve cyber resilience across the healthcare sector.

Categories
Health Law Highlights

OCR HIPAA Audit Program to Commence in 2024

Summary of article from The HIPAA Journal, by Steve Adler:

The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 mandates periodic audits of HIPAA-regulated entities by the Office for Civil Rights (OCR) to assess HIPAA compliance, with a focus on the HIPAA Security Rule. OCR has confirmed that audits will be conducted in 2024. The increasing rate and scale of data breaches suggest inadequate compliance with the HIPAA Security Rule among healthcare organizations. OCR aims to improve future audit programs and cybersecurity across the healthcare sector, with a particular focus on risk analysis and management provisions of the HIPAA Security Rule. OCR is working on an update to the HIPAA Security Rule, expected to be finalized by the end of the year, to reflect changes in technology and working practices, including the adoption of cloud technology, encryption, and multifactor authentication.

Categories
Health Law Highlights

A Comprehensive Guide to Creating a Sustainable Cookie Program

Summary of article from IAPP, by Jodi Daniels, CIPP/US:

Managing cookies is essential for compliance with privacy and data protection laws worldwide. Establishing a cookie governance program involves designating roles for program leadership, creating a comprehensive policy for cookie use and removal, and implementing systems to manage user consent. Regular audits and privacy impact assessments for new cookie use are necessary to ensure ongoing compliance. Employees should be trained on the cookie program and privacy practices, and privacy notices must accurately reflect the company’s cookie practices. As technologies and privacy laws evolve, businesses should regularly review and update their cookie governance program to maintain compliance.